First Governed Execution

Execute an HTTP request through the KorClaw runtime proxy after policy approval.

POST /runtime/execute evaluates the action against policies, then executes it through the runtime proxy if allowed. Supports http_proxy and mcp_proxy modes.

HTTP proxy execution

bash

curl -X POST https://app.korclaw.com/api/v1/runtime/execute \
  -H "Authorization: Bearer kc_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "action": "api_call",
      "resource": "https://api.example.com/data",
      "agent": "ops-bot",
      "environment": "production"
    },
    "execution": {
      "mode": "http_proxy",
      "method": "GET",
      "url": "https://api.example.com/data"
    }
  }'

Response

json

{
  "data": {
    "allowed": true,
    "result": "allowed",
    "execution": {
      "status": 200,
      "headers": { "content-type": "application/json" },
      "body": "{\"items\":[]}",
      "truncated": false
    }
  }
}

SSRF protection

The HTTP proxy blocks requests to private IPs, localhost, and link-local addresses. URLs with embedded credentials are rejected. Body size is capped at 1 MB with a 30-second timeout.

SDK enforce helper

typescript

const result = await korclaw.policies.enforce({
  input: { action: "api_call", resource: url, agent: "ops-bot" },
  execution: { mode: "http_proxy", method: "GET", url },
});
// Throws PolicyBlockedError or PolicyApprovalRequiredError if denied